Regular Expression Denial of Service in highcharts

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service ReDoS. Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgrade to...

GHSA-XMC8-CJFR-PHX3 Regular Expression Denial of Service in highcharts

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service ReDoS. Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgrade to...

Denial Of Service (DoS)

highcharts is vulnerable to denial of service. Backtracking regular expressions are permitted in js/parts/SvgRenderer.js, which would allow an attacker to perform regular expressions denial of service against the SVGRenderer component...

CVE-2018-20801

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

Code injection

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

CVE-2018-20801

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

CVE-2018-20801

Highcharts JS (before 6.1.0) has a Regular Expression Denial of Service (ReDoS) flaw in SvgRenderer.js due to backtracking regex usage. This could allow an attacker to disrupt the SVGRenderer component by processing crafted input. Remediation: upgrade to Highcharts 6.1.0 or newer. Affected CVE: C...

CVE-2018-20801

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

CVE-2018-20801

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

PT-2019-10243

Name of the Vulnerable Software and Affected Versions: Highcharts JS versions prior to 6.1.0 Description: The issue concerns a denial of service attack against the SVGRenderer component due to the use of backtracking regular expressions. Untrusted input may cause catastrophic backtracking while...

CVE-2018-20801: Incorrect Regular Expression

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

New Relic: Stored XSS in notes (charts) because of insecure chart data JSON generation

Hey team, I have discovered vulnerability of chart data JSON generation endpoint when the chart is displayed inside a note allowing attacker to inject arbitrary fields into it and leading to stored XSS. The impact is higher than usual here because the payload remains after publishing a note so th...

Nagios XI Magpie_debug.php Root Remote Code Execution

This module exploits two vulnerabilities in Nagios XI use exploit/linux/http/nagios/ximagpiedebug msf undefinedximagpiedebug show actions ...actions... msf undefinedximagpiedebug set ACTION msf undefinedximagpiedebug show options ...show and set options... msf undefinedximagpiedebug run This modu...

forum.highcharts.com XSS vulnerability

Open Bug Bounty ID: OBB-446580 Description| Value ---|--- Affected Website:| forum.highcharts.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

highcharts.com XSS vulnerability

Open Bug Bounty ID: OBB-238908 Description| Value ---|--- Affected Website:| highcharts.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Sucuri: Usage of HTTP for exporting graph data as images

Whenever a user of waf.sucuri.net exports his reports graph data as a png, an unencrypted request is sent over to export.highcharts.com. This enables a mitm-able attacker to sniff and|or replace exported image. Also, the whole practice of offloading potentially private user data to an unrelated...